jomo's blog about privacy, software, security
tl;dr? Jump to recommendations ! Introduction By default, any CA can issue certificates for any domain, and anyone in control of your IP address is able to request a certificate from such a CA. DNS Certification Authority Authorization (CAA) Resource Records allow you to define limitations on this. The standard is defined in RFC 8659 , and public CAs are required 1 to follow this standard. The…
I gave a talk about OSM at Fireshonks – one of the online events in place of the CCC ’s cancelled annual Chaos Communication Congress. Since a lot of the existing talks on OSM cover introduction / tutorials or a very specific subject, I wanted to give a talk for those already familiar with basic mapping. Specifically, I wanted viewers to understand the OSM ecosystem a little better and wanted to…
I gave an overview / introduction talk about OSINT and OPSEC at the CCC ’s annual Chaos Communication Congress ( rc3 NOWHERE ). OSINT is the extraction of information from freely available sources. But what exactly is OSINT and why is it useful not only for intelligence agencies and journalists? How can the smallest details be exploited to locate or date an inconspicuous photo? Which tools and…
A few days ago, I gained admin access to the ERP system of a German-based international online retailer 1 operating a number of e-commerce websites. The ERP system included sensitive employee data, customer data, and over 160k invoices. They quickly addressed the issues and the overall communication went very well. When I noticed that https://███████24.de/.git/config returned an actual git config…
This is a writeup of this year’s MRMCD CTF challenge “Flag Checker”, which I solved by hand while wondering how to let a computer solve this more elegantly. I thought about using Prolog until jn suggested using Z3, which I want to demonstrate in this post. Essentially, the challenge was made up of to these JavaScript functions: function isFlagCorrect(flag) { if (hash(flag.length) != 1801011984)…
Note : This post is a copy of https://paypal.gift . Web browsers show a padlock icon next to the URL of HTTPS websites with a valid TLS certificate . This padlock indicates that the connection between your browser and the server is secure. It does not indicate that the website is safe to use, or that the domain name is not misleading, or anything, really. It just means that you’re connected to the…
This is a writeup of this year’s MRMCD CTF challenge “Hatali”, including two different ways to solve the challenge (one of them being unintended by the challenge authors). We are presented with a simple login/register website. The site allows you to register – and then login with – any username/password combination. We’ll use admin:admin . The site sets a session cookie upon login:…
I participated in the MRMCD CTF and since they asked for writeups , here comes mine about the ‘Cofefe’ challenge. Provided was the following description: Do you have trouble to stay awake at the MRMCD? No problem, we can BREW some Covfefe with various additions for you! While drinking, you might also want to read /flag.txt? The challenge also had a website link and that website’s source code . 1…
I want to ensure no traffic is accidentally bypassing my VPN. Some VPN providers sell this as a “kill switch”. Fortunately, using pf (packet filter) on macOS it’s simple to do this yourself. Although macOS has an option called “Send all traffic over VPN connection”, this only works while the VPN is connected. Whenever it’s disconnected – and it sometimes does this on its own – all your traffic is…